From 0a39c004b14ae2d3eb055d0bb5172e18b1beed18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9sar=20Arroba?= Date: Mon, 17 Aug 2026 10:50:27 +0200 Subject: [PATCH] feat(permissions): default the real-time detection endpoint to Prowler Cloud ProwlerWebhookUrl and prowler_webhook_url now default to https://api.prowler.com/api/v1/realtime/events, matching the ingest path defined in the MVP and the API base already used elsewhere in the repo. Enabling real-time detection now only requires pasting the API key; the endpoint is overridden only for self-hosted deployments or testing. --- .../templates/cloudformation/prowler-scan-role.yml | 8 ++++---- permissions/templates/terraform/README.md | 5 +++-- permissions/templates/terraform/terraform.tfvars.example | 3 ++- permissions/templates/terraform/variables.tf | 4 ++-- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/permissions/templates/cloudformation/prowler-scan-role.yml b/permissions/templates/cloudformation/prowler-scan-role.yml index 08aacbca68..868486e4f7 100644 --- a/permissions/templates/cloudformation/prowler-scan-role.yml +++ b/permissions/templates/cloudformation/prowler-scan-role.yml @@ -80,10 +80,10 @@ Parameters: ProwlerWebhookUrl: Description: | - Prowler Cloud endpoint that receives the events. Provided during Prowler Cloud onboarding. - Required if EnableRealtimeDetection is true. + Prowler Cloud endpoint that receives the events. Defaults to the Prowler Cloud ingest endpoint; + change it only for a self-hosted deployment or for testing. Required if EnableRealtimeDetection is true. Type: String - Default: "" + Default: "https://api.prowler.com/api/v1/realtime/events" AllowedPattern: '^(https://.+)?$' ConstraintDescription: "ProwlerWebhookUrl must be an HTTPS URL." @@ -768,7 +768,7 @@ Metadata: - S3IntegrationBucketName - S3IntegrationBucketAccountId - Label: - default: Optional Real-Time Detection (Required if EnableRealtimeDetection is true) + default: Optional Real-Time Detection (ProwlerApiKey required if EnableRealtimeDetection is true) Parameters: - ProwlerWebhookUrl - ProwlerApiKey diff --git a/permissions/templates/terraform/README.md b/permissions/templates/terraform/README.md index af0d16c313..240ef458d2 100644 --- a/permissions/templates/terraform/README.md +++ b/permissions/templates/terraform/README.md @@ -26,7 +26,7 @@ This Terraform configuration creates the necessary IAM role and policies to allo - `s3_integration_bucket_name` (conditional): S3 bucket name for reports (required if `enable_s3_integration` is true) - `s3_integration_bucket_account_id` (conditional): S3 bucket owner account ID (required if `enable_s3_integration` is true) - `enable_realtime_detection` (optional): Forward the tracked CloudTrail management events to Prowler Cloud through an EventBridge API destination (default: false) -- `prowler_webhook_url` (conditional): Prowler Cloud endpoint that receives the events (required if `enable_realtime_detection` is true) +- `prowler_webhook_url` (optional): Prowler Cloud endpoint that receives the events (defaults to Prowler Cloud: `https://api.prowler.com/api/v1/realtime/events`; change it only for a self-hosted deployment or for testing) - `prowler_api_key` (conditional): Prowler Cloud API key used to authenticate the events (required if `enable_realtime_detection` is true) ### Usage Examples @@ -50,10 +50,11 @@ terraform apply \ terraform apply \ -var="external_id=your-external-id-here" \ -var="enable_realtime_detection=true" \ - -var="prowler_webhook_url=https://api.prowler.com/api/v1/realtime/events" \ -var="prowler_api_key=your-prowler-api-key-here" ``` +`prowler_webhook_url` already defaults to the Prowler Cloud ingest endpoint, so only the API key is needed. Override it for a self-hosted deployment or for testing. + > **Note:** the EventBridge rule is regional. It forwards only the events delivered to the default event bus of the region Terraform deploys to (`us-east-1` by default, see `versions.tf`). IAM events are global and always land in `us-east-1`, but regional services (EC2 security groups, RDS, per-region Config and GuardDuty) are only covered in that region. Deploy the module in every region you want covered. #### Using terraform.tfvars file (Recommended) diff --git a/permissions/templates/terraform/terraform.tfvars.example b/permissions/templates/terraform/terraform.tfvars.example index 32f3ad898e..0182830568 100644 --- a/permissions/templates/terraform/terraform.tfvars.example +++ b/permissions/templates/terraform/terraform.tfvars.example @@ -40,7 +40,8 @@ external_id = "your-unique-external-id-here" # Enable real-time detection # enable_realtime_detection = true -# Prowler Cloud endpoint that receives the events (provided during onboarding) +# Prowler Cloud endpoint that receives the events (leave default unless +# self-hosted or testing against another endpoint) # prowler_webhook_url = "https://api.prowler.com/api/v1/realtime/events" # Prowler Cloud API key used to authenticate the events (shown once during onboarding) diff --git a/permissions/templates/terraform/variables.tf b/permissions/templates/terraform/variables.tf index 0a0b495832..2b8deb268c 100644 --- a/permissions/templates/terraform/variables.tf +++ b/permissions/templates/terraform/variables.tf @@ -69,8 +69,8 @@ variable "enable_realtime_detection" { variable "prowler_webhook_url" { type = string - description = "Prowler Cloud endpoint that receives the events. Provided during Prowler Cloud onboarding. Required if enable_realtime_detection is true." - default = "" + description = "Prowler Cloud endpoint that receives the events. Defaults to the Prowler Cloud ingest endpoint; change it only for a self-hosted deployment or for testing." + default = "https://api.prowler.com/api/v1/realtime/events" validation { condition = var.prowler_webhook_url == "" || can(regex("^https://", var.prowler_webhook_url))